Using host-based digital forensic analysis, CTU analysts observed the intruders using ‘at.exe’ to move laterally within the infrastructure.

Where You AT?: Indicators of Lateral Movement Using at.exe on Windows 7 Systems

SecureWorks Counter Threat Unit™ analysts observed the use of Unicode characters within the Windows Registry.

Using Unicode to Hide Malware Within the File System

Malware can be inserted through Unicode character encoding by character manipulation while being undetectable to the end user.

How to Hide Malware in Unicode

Harlan

セキュアワークスの緊急インシデント対応チームが直ちにに出動し、サイバーインシデントやデータ漏洩リスクへの対応および修復のサポートを24時間体制で提供します。お電話は24時間いつでも受付けています。

メニューや検索機能をご利用いただくか、URLを再確認してください。

Secureworksのホームページはこちら

script-src 'self' 'nonce-#nonce#' 'sha256-IgMQOOOedQeMPBl7lSreMVPmJvU62bc6l8HcsGXnbWc=' 'sha256-XJEfHQ97N7xwKM6MQXMpabeUHxVT647JYAYwrOX6sQQ=' 'sha256-WJHVKi7ReHnWJF4AUmd9vWDpqeX8GVtEsyAJP01M130=' 'sha256-lVilk2e8qE1rxMg9jxL8K48EwZUpx7Xrf/mm/A5yXWM=' 'sha256-DIygzAg/0fLKA/hDn0YGU7s62O7L/lceyCzUXjE3Pps=' https://code.jquery.com https://pages.secureworks.com https://js-agent.newrelic.com https://bam.nr-data.net https://content.secureworks.com https://content.secureworks.jp https://munchkin.marketo.net https://app-ab44.marketo.com https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://www.google-analytics.com https://ssl.google-analytics.com https://www.googletagmanager.com https://ajax.googleapis.com https://tagmanager.google.com https://translate.google.com https://bat.bing.com https://connect.facebook.net https://ad.atdmt.com https://static.ads-twitter.com https://analytics.twitter.com https://www.linkedin.com https://px.ads.linkedin.com https://snap.licdn.com https://j.6sc.co https://b.6sc.co https://*.6sc.co https://epsilon.6sense.com https://*.rlcdn.com https://gateway.zscaler.net https://geolocation.onetrust.com https://optanon.blob.core.windows.net https://cdn.cookielaw.org https://*.drift.com https://*.driftt.com https://*.simplecast.com https://*.crazyegg.com https://script.crazyegg.com https://hammock.hotprofile.biz https://*.hotprofile.biz https://*.hot-profile.com https://*.on24.com https://*.ceros.com https://*.redditstatic.com https://*.ensighten.com https://*.ml314.com https://*.choozle.com https://*.bluekai.com https://cdn.bizible.com https://cdn.bizibly.com https://ws-assets.zoominfo.com https://ws.zoominfo.com https://insight.adsrvr.org https://js.adsrvr.org https://*.clarity.ms https://static.ads-twitter.com https://cdn.pdst.fm https://*.cloudfunctions.net https://tag.demandbase.com https://*.bidr.io https://*.company-target.com https://www.teads.com https://p.teads.tv https://www.facebook.com connect.facebook.net; img-src 'self' https://*.teads.tv https://*.jsdelivr.net *.hot-profile.com reviews.static.gartner.com dam.secureworks.com *.vidyard.com cdn.jsdelivr.net googleads.g.doubleclick.net content.secureworks.com *.secureworks.jp id.rlcdn.com *.googletagmanager.com cdn.cookielaw.org *.gstatic.com optanon.blob.core.windows.net web.secureworks.com bat.bing.com *.google-analytics.com j.6sc.co b.6sc.co c.6sc.co epsilon.6sense.com www.google.com attr.ml-api.io s.ml-attr.com www.google.com.ua secure.adnxs.com apt.techtarget.com id.rlcdn.com px.ads.linkedin.com *.adslinkedin.com p.adsymptotic.com www.linkedin.com static.ziftsolutions.com *.crazyegg.com *.redditstatic.com alb.reddit.com *.ensighten.com ml314.com *.choozle.com *.bluekai.com cdn.bizible.com cdn.bizibly.com tracking.monsido.com *.clarity.ms analytics.twitter.com t.co *.bidr.io *.company-target.com www.facebook.com t.teads.tv https://ssl.gstatic.com *.secureworks.com *.secureworks.jp https://www.gstatic.com blob: data:; frame-ancestors 'self' *.folloze.com https://calculator.value-cloud.com *.secureworks.com *.secureworks.jp; worker-src 'self' blob: data:;

RELATED BLOGS

Where You AT?: Indicators of Lateral Movement Using at.exe on Windows 7 Systems